Has my Mac been hacked? How to check, and what to do

Hacked, infected, or a scam?

What looks like hacking is usually one of three different things, and each has its own fix:

• A scam: a pop-up in your browser, or an email saying your Mac is hacked or that you were recorded through your camera. Nothing on your Mac changed. See the Apple Security Alert scam; an email asking for payment in bitcoin is sextortion, and the right answer is to delete it.
• Malware or adware: a changed home page or search engine, ads where there were none, apps you didn't install. See how to remove malware from a Mac.
• A hacked account: sign-in alerts, password-reset emails you didn't request, messages sent in your name. Someone has your password, but not necessarily your Mac. Start with step 6 below.

Someone actually controlling a Mac is the rarest case. It usually starts with a remote-support app installed during a fake tech-support call, or with someone who had the Mac in their hands.

Signs someone has access to your Mac

• The pointer moves, windows open, or text is typed when you aren't doing it.
• A remote-control app such as AnyDesk, TeamViewer or a screen-sharing tool that you didn't install, or that someone asked you to install on a call.
• A user account in Users & Groups that you didn't create, or your password suddenly no longer works.
• The green camera light or the orange microphone dot appears when no app you opened should be using them.
• Settings changed back after you fixed them, such as the firewall turned off or a profile you can't remove.

1. Disconnect from the internet

Turn off Wi-Fi or unplug the cable before you start. Remote control and data uploads stop, and whoever is connected can't watch what you check or undo it. Turn it back on only when you need it, for example to change passwords at the end.

2. Turn off remote access

Open System Settings › General › Sharing. Turn off everything you don't use yourself, in particular Screen Sharing, Remote Management, Remote Login, File Sharing and Remote Apple Events. Remote Login lets anyone with an account's password run commands on your Mac over the network.

Then look in Applications for remote-control apps, such as AnyDesk, TeamViewer, Splashtop, ConnectWise or RustDesk. If you didn't install one for a reason you know, quit it and remove it, together with its helpers; see how to uninstall apps completely.

3. Check the user accounts

Open System Settings › Users & Groups. Every account listed can sign in to the Mac, and an Admin can change anything on it. Delete accounts you didn't create, and make sure only you are an administrator. Then change your own Mac password with Change Password, in case someone knows the old one.

4. Check which apps can watch or control the Mac

Open System Settings › Privacy & Security and go through these lists. Turn off, or remove with the − button, any app you don't recognise or no longer use:

• Accessibility: the app can control your Mac, click and type for you.
• Screen & System Audio Recording: the app can see everything on your screen.
• Input Monitoring: the app can read what you type, passwords included.
• Full Disk Access, Camera and Microphone.

While a microphone is in use, an orange dot shows in the menu bar; the camera has its green light. Open Control Center to see which app is using them, or used them last.

5. Check what starts with your Mac

Anything that keeps access has to start itself again after a restart. Check System Settings › General › Login Items & Extensions and the launch agent folders, as described in how to remove malware from a Mac, and remove profiles you didn't install under General › Device Management. Then run a malware scan.

6. Check your accounts, from another device

1. Apple Account: on account.apple.com, or in System Settings under your name, look at Devices. Remove any you don't own, then change the password. If someone else has it, they can see your iCloud photos, messages and backups, and lock your devices with Find My.
2. Email: check the recent sign-in activity and the forwarding rules. A rule that forwards your mail elsewhere is how an attacker keeps getting your reset codes after you change the password.
3. Change the passwords of your email, Apple Account, bank and every account saved in your browser, starting with email, and sign out of all other sessions where the site offers it.
4. Turn on two-factor authentication everywhere, preferably with an authenticator app or a passkey instead of text messages.

Do this from a phone or another computer you trust: if the Mac is still compromised, new passwords typed on it can be stolen too.

If you let a scammer onto your Mac

If someone you don't know had remote control, through a fake support call or a fake refund for example, assume they saw what was on your screen and may have installed something to come back. Call your bank first if they saw or touched online banking. Then do all the steps above, and consider erasing the Mac: back up your documents, then choose System Settings › General › Transfer or Reset › Erase All Content and Settings, and reinstall your apps from their developers.

Check your Mac with Tidy My Mac

• Security Settings scores your Mac's protections, FileVault, the firewall, Gatekeeper and SIP among them, and says how to fix each one that is off.
• Privacy Access lists every app allowed to use your camera, microphone, screen and files in one place, and Sudo Activity shows the commands run with administrator rights in the last 30 days.
• Antivirus scans for malware and remote-access trojans, Startup Items shows everything that starts with your Mac, and the Firewall shows which apps connect out, and blocks them.